Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
3308 vulnerabilities reference this CWE, most recent first.
GHSA-GWM7-84HQ-WRQ2
Vulnerability from github – Published: 2023-12-20 18:30 – Updated: 2026-04-28 21:33
VLAI
Details
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-35914"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-20T16:15:08Z",
"severity": "HIGH"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.",
"id": "GHSA-gwm7-84hq-wrq2",
"modified": "2026-04-28T21:33:29Z",
"published": "2023-12-20T18:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35914"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/woocommerce-subscriptions/wordpress-woocommerce-subscriptions-plugin-5-1-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GWPX-Q2H9-WXGX
Vulnerability from github – Published: 2021-12-03 20:43 – Updated: 2021-12-03 15:16
VLAI
Summary
elgg is vulnerable to Authorization Bypass Through User-Controlled Key
Details
elgg is vulnerable to Authorization Bypass Through User-Controlled Key
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "elgg/elgg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3964"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2021-12-02T21:20:04Z",
"nvd_published_at": "2021-12-01T12:15:00Z",
"severity": "MODERATE"
},
"details": "elgg is vulnerable to Authorization Bypass Through User-Controlled Key",
"id": "GHSA-gwpx-q2h9-wxgx",
"modified": "2021-12-03T15:16:06Z",
"published": "2021-12-03T20:43:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3964"
},
{
"type": "WEB",
"url": "https://github.com/elgg/elgg/commit/d9fcad76ee380ea17edd61d13d0f87828ea3f744"
},
{
"type": "WEB",
"url": "https://github.com/elgg/elgg"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a4df45d6-b739-4299-967f-c960b569383a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "elgg is vulnerable to Authorization Bypass Through User-Controlled Key"
}
GHSA-GX48-Q3WG-HQGQ
Vulnerability from github – Published: 2022-05-13 01:22 – Updated: 2022-05-13 01:22
VLAI
Details
An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs (backup and synchronization jobs), which could allow for the possibility of a Denial of Service attack via a modified jobId parameter in a runJob.html GET request.
Severity
9.4 (Critical)
{
"affected": [],
"aliases": [
"CVE-2019-6716"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-21T16:01:00Z",
"severity": "CRITICAL"
},
"details": "An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs (backup and synchronization jobs), which could allow for the possibility of a Denial of Service attack via a modified jobId parameter in a runJob.html GET request.",
"id": "GHSA-gx48-q3wg-hqgq",
"modified": "2022-05-13T01:22:46Z",
"published": "2022-05-13T01:22:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6716"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46254"
},
{
"type": "WEB",
"url": "https://www.logonbox.com/en"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/151373/LongBox-Limited-Access-Manager-Insecure-Direct-Object-Reference.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GX7V-VCR7-WXQP
Vulnerability from github – Published: 2025-11-12 06:30 – Updated: 2025-11-12 06:30
VLAI
Details
The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.22 via the 'awwlm_remove_added_wishlist_page' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete wishlist items from other user's wishlists.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-12087"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-12T05:15:39Z",
"severity": "MODERATE"
},
"details": "The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.22 via the \u0027awwlm_remove_added_wishlist_page\u0027 AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete wishlist items from other user\u0027s wishlists.",
"id": "GHSA-gx7v-vcr7-wxqp",
"modified": "2025-11-12T06:30:24Z",
"published": "2025-11-12T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12087"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/log/aco-wishlist-for-woocommerce"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17e8a743-7985-4b28-b854-ac052a834f3a?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GX9C-69HC-CJMJ
Vulnerability from github – Published: 2026-04-08 09:31 – Updated: 2026-04-08 09:31
VLAI
Details
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2s_id' parameter belongs to the current user before performing UPDATE and DELETE operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify, reschedule, or delete other users' scheduled social media posts.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-4330"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T08:16:23Z",
"severity": "MODERATE"
},
"details": "The Blog2Social: Social Media Auto Post \u0026 Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin\u0027s AJAX handlers failing to validate that the user-supplied \u0027b2s_id\u0027 parameter belongs to the current user before performing UPDATE and DELETE operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify, reschedule, or delete other users\u0027 scheduled social media posts.",
"id": "GHSA-gx9c-69hc-cjmj",
"modified": "2026-04-08T09:31:31Z",
"published": "2026-04-08T09:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4330"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/tags/8.8.2/includes/Ajax/Post.php#L2178"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/tags/8.8.2/includes/Ajax/Post.php#L2183"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/tags/8.8.2/includes/Ajax/Post.php#L2273"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/tags/8.8.2/includes/Ajax/Post.php#L2322"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/tags/8.8.2/includes/B2S/Post/Tools.php#L32"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/tags/8.8.2/includes/B2S/Ship/Save.php#L190"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/tags/8.8.2/includes/Loader.php#L2202"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/Ajax/Post.php#L2178"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/Ajax/Post.php#L2183"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/Ajax/Post.php#L2273"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/Ajax/Post.php#L2322"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/B2S/Post/Tools.php#L32"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/B2S/Ship/Save.php#L190"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/Loader.php#L2202"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3494550"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3eec9c6-fef9-4d6e-8328-51efb997c99c?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GX9Q-PJVG-G34Q
Vulnerability from github – Published: 2025-04-16 00:31 – Updated: 2025-04-16 00:31
VLAI
Details
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-31147"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-15T22:15:27Z",
"severity": "MODERATE"
},
"details": "Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.",
"id": "GHSA-gx9q-pjvg-g34q",
"modified": "2025-04-16T00:31:38Z",
"published": "2025-04-16T00:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31147"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GXH9-4VGJ-W44J
Vulnerability from github – Published: 2025-08-13 18:31 – Updated: 2025-08-13 18:31
VLAI
Details
An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-8770"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-13T18:15:33Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers.",
"id": "GHSA-gxh9-4vgj-w44j",
"modified": "2025-08-13T18:31:25Z",
"published": "2025-08-13T18:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8770"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/549105"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GXRV-WF35-62W9
Vulnerability from github – Published: 2024-07-05 20:13 – Updated: 2024-07-09 21:58
VLAI
Summary
Bypassing IP allow-lists in traefik via HTTP/3 early data requests in QUIC 0-RTT handshakes
Details
Impact
There is a vulnerability in Traefik that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses.
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.6
- https://github.com/traefik/traefik/releases/tag/v3.0.4
- https://github.com/traefik/traefik/releases/tag/v3.1.0-rc3
Workarounds
No workaround.
For more information
If you have any questions or comments about this advisory, please open an issue.
Original Description ### Summary Bypassing IP allow-lists in traefik via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. ### Details HTTP/3 supports sending HTTP requests as early data during QUIC 0-RTT handshakes to reduce RTT overhead for connection resumptions. Early data is sent and received before the handshake is completed and the client's IP address is validated. The initial packet containing the QUIC 0-RTT handshake information and the early data HTTP request are sent as a single UDP datagram. Due to UDP being used by QUIC, the source IP address can be spoofed. When HTTP/3 servers process early data requests, the application layer only sees the unvalidated - possibly spoofed - IP address. First, attackers have to obtain a session ticket from the HTTP/3 server. For that, attackers have to establish an HTTP/3 connection to the server - using their real IP address - and wait for the server to send a session ticket. Note that attackers do not have to send an actual HTTP request over the established connection. After obtaining the session ticket, the attacker can close the connection. In the second step, attackers need to prepare a UDP datagram containing a QUIC initial packet with a TLS ClientHello and the session ticket, a QUIC 0-RTT packet with early data encrypted with the pre-shared key from the session ticket, and an HTTP/3 request (open request stream, HEADERS frame, optionally DATA frame). This prepared UDP datagram can then be sent to the server with an arbitrarily spoofed source IP address in the IP packet header. When processing the HTTP request, the server trusts the spoofed IP address, which can be used to bypass IP-allow/block-lists. A prerequisite for this attack to succeed is that HTTP/3 servers have implemented and enabled 0-RTT early data for HTTP/3 requests (and no mitigations are in place). A caveat is that attackers are not able to receive the server's response because the response is sent to the spoofed source IP address, making it a blind attack. Another limitation is that the request has to fit in a single UDP datagram, whose size is limited by the network path's MTU (minus some bytes for headers of encapsulating protocols such as HTTP/3, QUIC, UDP, IPv4/IPv6). ### Impact IP allow-lists can be bypassed. Early data in QUIC 0-RTT handshakes is enabled when HTTP/3 support is enabled. ### Mitigation * Consider responding with HTTP status code 425 Too Early when 0-RTT early data requests match `ipAllowList.sourceRange` middleware. See RFC 8470 Section 3 for more information. * Alternatively, delay processing of 0-RTT early data requests until the handshake is completed and the client's IP address is validated when 0-RTT early data requests match `ipAllowList.sourceRange` middleware. Additionally, it is recommended to implement RFC 8470 and set the `Early-Data: 1` header when forwarding early data requests to backend services. Currently, applications are not able to distinguish between 0-RTT early data requests and regular requests. When applications use the client's IP in `X-Forwarded-For` headers (e.g. for rate limiting), they are not able to detect potential IP spoofing on the application layer. ### Proof of Concept Traefik is used as a HTTP/3 reverse proxy for a backend application. An IP allow list is configured to only allow access from the IP address 1.3.3.7.# /etc/traefik/traefik.yml
entryPoints:
websecure:
address: ":4439"
http3: {}
asDefault: true
providers:
file:
filename: /etc/traefik/provider.yml
log:
level: DEBUG
# /etc/traefik/provider.yml
http:
routers:
default:
rule: "PathPrefix(`/`)"
tls: {}
middlewares:
- ipfilter
service: backend
middlewares:
ipfilter:
ipAllowList:
sourceRange:
- "1.3.3.7/32"
services:
backend:
loadBalancer:
servers:
- url: "http://127.0.0.1:8000"
python3 http3_ip_spoofing.py https://127.0.0.1:4439/cmd -X POST -d "cmd=echo%20worked>>/tmp/spoofed" -H "X-Header: test" --spoofed-ip=1.3.3.7
docker compose up
# Traefik startup logs
h3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:100 > Traefik version 3.0.3 built on 2024-06-18T14:31:20Z version=3.0.3
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/cmd/traefik/traefik.go:107 > Static configuration loaded [json] staticConfiguration={"entryPoints":{"websecure":{"address":":4439","asDefault":true,"forwardedHeaders":{},"http":{},"http2":{"maxConcurrentStreams":250},"http3":{},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}}},"global":{"checkNewVersion":true},"log":{"format":"common","level":"DEBUG"},"providers":{"file":{"filename":"/etc/traefik/provider.yml","watch":true},"providersThrottleDuration":"2s"},"serversTransport":{"maxIdleConnsPerHost":200},"tcpServersTransport":{"dialKeepAlive":"15s","dialTimeout":"30s"}}
h3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:605 >
h3_traefik-1 | Stats collection is disabled.
h3_traefik-1 | Help us improve Traefik by turning this feature on :)
h3_traefik-1 | More details on: https://doc.traefik.io/traefik/contributing/data-collection/
h3_traefik-1 |
h3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:73 > Starting provider aggregator aggregator.ProviderAggregator
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:220 > Starting TCP Server entryPointName=websecure
h3_traefik-1 | 2024-06-29T11:52:58Z DBG log/log.go:245 > 2024/06/29 11:52:58 sys_conn.go:36: failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
h3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *file.Provider
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *file.Provider provider configuration config={"filename":"/etc/traefik/provider.yml","watch":true}
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/provider/file/file.go:122 > add watcher on: /etc/traefik
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/provider/file/file.go:122 > add watcher on: /etc/traefik/provider.yml
h3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *traefik.Provider
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *traefik.Provider provider configuration config={}
h3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *acme.ChallengeTLSALPN
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *acme.ChallengeTLSALPN provider configuration config={}
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{"middlewares":{"ipfilter":{"ipAllowList":{"sourceRange":["1.3.3.7/32"]}}},"routers":{"default":{"middlewares":["ipfilter"],"rule":"PathPrefix(`/`)","service":"backend","tls":{}}},"services":{"backend":{"loadBalancer":{"passHostHeader":true,"responseForwarding":{"flushInterval":"100ms"},"servers":[{"url":"http://127.0.0.1:8000"}]}}}},"tcp":{},"tls":{},"udp":{}} providerName=file
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{"serversTransports":{"default":{"maxIdleConnsPerHost":200}},"services":{"noop":{}}},"tcp":{"serversTransports":{"default":{"dialKeepAlive":"15s","dialTimeout":"30s"}}},"tls":{},"udp":{}} providerName=internal
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/aggregator.go:51 > No entryPoint defined for this router, using the default one(s) instead entryPointName=["websecure"] routerName=default
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:321 > No default certificate, fallback to the internal generated certificate tlsStoreName=default
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/service/service.go:259 > Creating load-balancer entryPointName=websecure routerName=default@file serviceName=backend@file
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/service/service.go:301 > Creating server entryPointName=websecure routerName=default@file serverName=754e0da3b063885a serviceName=backend@file target=http://127.0.0.1:8000
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/middlewares/ipallowlist/ip_allowlist.go:33 > Creating middleware entryPointName=websecure middlewareName=ipfilter@file middlewareType=IPAllowLister routerName=default@file
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/middlewares/ipallowlist/ip_allowlist.go:57 > Setting up IPAllowLister with sourceRange: [1.3.3.7/32] entryPointName=websecure middlewareName=ipfilter@file middlewareType=IPAllowLister routerName=default@file
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/middlewares/observability/middleware.go:33 > Adding tracing to middleware entryPointName=websecure middlewareName=ipfilter@file routerName=default@file
h3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:22 > Creating middleware entryPointName=websecure middlewareName=traefik-internal-recovery middlewareType=Recover
# Attack script establishes an HTTP/3 connection to traefik to obtain a session ticket
attack-ipspoofing-1 | INFO:client:Initially connecting to server to get a session ticket
attack-ipspoofing-1 | INFO:quic:[e29b2e2fd9a76162] ALPN negotiated protocol h3
attack-ipspoofing-1 | INFO:quic:[e29b2e2fd9a76162] Connection close sent (code 0x0, reason )
attack-ipspoofing-1 | INFO:client:Initial connection done
# Traefik accepts the HTTP/3 connection and issues as session ticket
h3_traefik-1 | 2024-06-29T11:53:03Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:228 > Serving default certificate for request: ""
# Attack script sends a 0-RTT early data request in a UDP datagram with a spoofed source IP
attack-ipspoofing-1 | INFO:client:Building 0-RTT QUIC packet
attack-ipspoofing-1 | INFO:client:Setting up iptables rule for source IP spoofing
attack-ipspoofing-1 | INFO:client:Sending 0-RTT packet
# Traefik accepts and forwards the request to the backend service, bypassing the IP allow list
h3_traefik-1 | 2024-06-29T11:53:05Z DBG github.com/traefik/traefik/v3/pkg/middlewares/ipallowlist/ip_allowlist.go:85 > Accepting IP 1.3.3.7 middlewareName=ipfilter@file middlewareType=IPAllowLister
h3_traefik-1 | 2024-06-29T11:53:05Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:196 > Service selected by WRR: 754e0da3b063885a
# Backend service receives and processes the request
backend-1 | INFO:root:Request: {"ip": "1.3.3.7", "method": "POST", "path": "/cmd", "data": "cmd=echo%20worked>>/tmp/spoofed", "headers": {"Host": "127.0.0.1:4439", "Content-Length": "31", "Content-Type": "application/x-www-form-urlencoded", "X-Forwarded-For": "1.3.3.7", "X-Forwarded-Host": "127.0.0.1:4439", "X-Forwarded-Port": "4439", "X-Forwarded-Proto": "https", "X-Forwarded-Server": "work", "X-Header": "test", "X-Real-Ip": "1.3.3.7", "Accept-Encoding": "gzip"}}
backend-1 | INFO:root:Executing command: echo worked>>/tmp/spoofed
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.11.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v3"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0-beta3"
},
{
"fixed": "3.0.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v3"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0-rc1"
},
{
"fixed": "3.1.0-rc3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-39321"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-05T20:13:50Z",
"nvd_published_at": "2024-07-05T18:15:32Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThere is a vulnerability in Traefik that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses.\n\n### Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.6\n- https://github.com/traefik/traefik/releases/tag/v3.0.4\n- https://github.com/traefik/traefik/releases/tag/v3.1.0-rc3\n\n### Workarounds\n\nNo workaround.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n### Summary\nBypassing IP allow-lists in traefik via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses.\n\n\n### Details\nHTTP/3 supports sending HTTP requests as early data during QUIC 0-RTT handshakes to reduce RTT overhead for connection resumptions. Early data is sent and received before the handshake is completed and the client\u0027s IP address is validated.\nThe initial packet containing the QUIC 0-RTT handshake information and the early data HTTP request are sent as a single UDP datagram. Due to UDP being used by QUIC, the source IP address can be spoofed. When HTTP/3 servers process early data requests, the application layer only sees the unvalidated - possibly spoofed - IP address.\n\nFirst, attackers have to obtain a session ticket from the HTTP/3 server. For that, attackers have to establish an HTTP/3 connection to the server - using their real IP address - and wait for the server to send a session ticket. Note that attackers do not have to send an actual HTTP request over the established connection. After obtaining the session ticket, the attacker can close the connection. In the second step, attackers need to prepare a UDP datagram containing a QUIC initial packet with a TLS ClientHello and the session ticket, a QUIC 0-RTT packet with early data encrypted with the pre-shared key from the session ticket, and an HTTP/3 request (open request stream, HEADERS frame, optionally DATA frame). This prepared UDP datagram can then be sent to the server with an arbitrarily spoofed source IP address in the IP packet header. When processing the HTTP request, the server trusts the spoofed IP address, which can be used to bypass IP-allow/block-lists.\n\nA prerequisite for this attack to succeed is that HTTP/3 servers have implemented and enabled 0-RTT early data for HTTP/3 requests (and no mitigations are in place). A caveat is that attackers are not able to receive the server\u0027s response because the response is sent to the spoofed source IP address, making it a blind attack. Another limitation is that the request has to fit in a single UDP datagram, whose size is limited by the network path\u0027s MTU (minus some bytes for headers of encapsulating protocols such as HTTP/3, QUIC, UDP, IPv4/IPv6).\n\n\n### Impact\nIP allow-lists can be bypassed. Early data in QUIC 0-RTT handshakes is enabled when HTTP/3 support is enabled.\n\n### Mitigation\n* Consider responding with HTTP status code 425 Too Early when 0-RTT early data requests match `ipAllowList.sourceRange` middleware. See RFC 8470 Section 3 for more information.\n* Alternatively, delay processing of 0-RTT early data requests until the handshake is completed and the client\u0027s IP address is validated when 0-RTT early data requests match `ipAllowList.sourceRange` middleware.\n\nAdditionally, it is recommended to implement RFC 8470 and set the `Early-Data: 1` header when forwarding early data requests to backend services. Currently, applications are not able to distinguish between 0-RTT early data requests and regular requests. When applications use the client\u0027s IP in `X-Forwarded-For` headers (e.g. for rate limiting), they are not able to detect potential IP spoofing on the application layer.\n\n\n### Proof of Concept\nTraefik is used as a HTTP/3 reverse proxy for a backend application. An IP allow list is configured to only allow access from the IP address 1.3.3.7.\n\n```yaml\n# /etc/traefik/traefik.yml\nentryPoints:\n websecure:\n address: \":4439\"\n http3: {}\n asDefault: true\n\nproviders:\n file:\n filename: /etc/traefik/provider.yml\n\nlog:\n level: DEBUG\n```\n\n```yaml\n# /etc/traefik/provider.yml\nhttp:\n routers:\n default:\n rule: \"PathPrefix(`/`)\"\n tls: {}\n middlewares:\n - ipfilter\n service: backend\n \n middlewares:\n ipfilter:\n ipAllowList:\n sourceRange:\n - \"1.3.3.7/32\"\n\n services:\n backend:\n loadBalancer:\n servers:\n - url: \"http://127.0.0.1:8000\"\n```\n\n\nBy performing the steps described above, attackers are able to bypass the IP allow list and send requests to the backend application. The security impact depends on the application\u0027s logic.\n\nPlease find attached a proof-of-concept docker-compose setup to demonstrate the vulnerability. It consists of a traefik reverse proxy, a backend application, and an attacker container. The attack script performs following request:\n```\npython3 http3_ip_spoofing.py https://127.0.0.1:4439/cmd -X POST -d \"cmd=echo%20worked\u003e\u003e/tmp/spoofed\" -H \"X-Header: test\" --spoofed-ip=1.3.3.7\n```\nNote: We use a custom python script because, `curl` does not support QUIC 0-RTT requests and session resumtion yet.\n\n[proof-of-concept.zip](https://github.com/user-attachments/files/16044048/proof-of-concept.zip)\n\n\nHere are logs of a successful exploitation in the attached docker compose setup:\n```\ndocker compose up\n\n# Traefik startup logs\nh3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:100 \u003e Traefik version 3.0.3 built on 2024-06-18T14:31:20Z version=3.0.3\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/cmd/traefik/traefik.go:107 \u003e Static configuration loaded [json] staticConfiguration={\"entryPoints\":{\"websecure\":{\"address\":\":4439\",\"asDefault\":true,\"forwardedHeaders\":{},\"http\":{},\"http2\":{\"maxConcurrentStreams\":250},\"http3\":{},\"transport\":{\"lifeCycle\":{\"graceTimeOut\":\"10s\"},\"respondingTimeouts\":{\"idleTimeout\":\"3m0s\",\"readTimeout\":\"1m0s\"}},\"udp\":{\"timeout\":\"3s\"}}},\"global\":{\"checkNewVersion\":true},\"log\":{\"format\":\"common\",\"level\":\"DEBUG\"},\"providers\":{\"file\":{\"filename\":\"/etc/traefik/provider.yml\",\"watch\":true},\"providersThrottleDuration\":\"2s\"},\"serversTransport\":{\"maxIdleConnsPerHost\":200},\"tcpServersTransport\":{\"dialKeepAlive\":\"15s\",\"dialTimeout\":\"30s\"}}\nh3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:605 \u003e \nh3_traefik-1 | Stats collection is disabled.\nh3_traefik-1 | Help us improve Traefik by turning this feature on :)\nh3_traefik-1 | More details on: https://doc.traefik.io/traefik/contributing/data-collection/\nh3_traefik-1 | \nh3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:73 \u003e Starting provider aggregator aggregator.ProviderAggregator\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:220 \u003e Starting TCP Server entryPointName=websecure\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG log/log.go:245 \u003e 2024/06/29 11:52:58 sys_conn.go:36: failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.\nh3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 \u003e Starting provider *file.Provider\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 \u003e *file.Provider provider configuration config={\"filename\":\"/etc/traefik/provider.yml\",\"watch\":true}\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/provider/file/file.go:122 \u003e add watcher on: /etc/traefik\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/provider/file/file.go:122 \u003e add watcher on: /etc/traefik/provider.yml\nh3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 \u003e Starting provider *traefik.Provider\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 \u003e *traefik.Provider provider configuration config={}\nh3_traefik-1 | 2024-06-29T11:52:58Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 \u003e Starting provider *acme.ChallengeTLSALPN\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 \u003e *acme.ChallengeTLSALPN provider configuration config={}\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 \u003e Configuration received config={\"http\":{\"middlewares\":{\"ipfilter\":{\"ipAllowList\":{\"sourceRange\":[\"1.3.3.7/32\"]}}},\"routers\":{\"default\":{\"middlewares\":[\"ipfilter\"],\"rule\":\"PathPrefix(`/`)\",\"service\":\"backend\",\"tls\":{}}},\"services\":{\"backend\":{\"loadBalancer\":{\"passHostHeader\":true,\"responseForwarding\":{\"flushInterval\":\"100ms\"},\"servers\":[{\"url\":\"http://127.0.0.1:8000\"}]}}}},\"tcp\":{},\"tls\":{},\"udp\":{}} providerName=file\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 \u003e Configuration received config={\"http\":{\"serversTransports\":{\"default\":{\"maxIdleConnsPerHost\":200}},\"services\":{\"noop\":{}}},\"tcp\":{\"serversTransports\":{\"default\":{\"dialKeepAlive\":\"15s\",\"dialTimeout\":\"30s\"}}},\"tls\":{},\"udp\":{}} providerName=internal\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/aggregator.go:51 \u003e No entryPoint defined for this router, using the default one(s) instead entryPointName=[\"websecure\"] routerName=default\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:321 \u003e No default certificate, fallback to the internal generated certificate tlsStoreName=default\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/service/service.go:259 \u003e Creating load-balancer entryPointName=websecure routerName=default@file serviceName=backend@file\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/server/service/service.go:301 \u003e Creating server entryPointName=websecure routerName=default@file serverName=754e0da3b063885a serviceName=backend@file target=http://127.0.0.1:8000\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/middlewares/ipallowlist/ip_allowlist.go:33 \u003e Creating middleware entryPointName=websecure middlewareName=ipfilter@file middlewareType=IPAllowLister routerName=default@file\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/middlewares/ipallowlist/ip_allowlist.go:57 \u003e Setting up IPAllowLister with sourceRange: [1.3.3.7/32] entryPointName=websecure middlewareName=ipfilter@file middlewareType=IPAllowLister routerName=default@file\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/middlewares/observability/middleware.go:33 \u003e Adding tracing to middleware entryPointName=websecure middlewareName=ipfilter@file routerName=default@file\nh3_traefik-1 | 2024-06-29T11:52:58Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:22 \u003e Creating middleware entryPointName=websecure middlewareName=traefik-internal-recovery middlewareType=Recover\n\n# Attack script establishes an HTTP/3 connection to traefik to obtain a session ticket\nattack-ipspoofing-1 | INFO:client:Initially connecting to server to get a session ticket\nattack-ipspoofing-1 | INFO:quic:[e29b2e2fd9a76162] ALPN negotiated protocol h3\nattack-ipspoofing-1 | INFO:quic:[e29b2e2fd9a76162] Connection close sent (code 0x0, reason )\nattack-ipspoofing-1 | INFO:client:Initial connection done\n\n# Traefik accepts the HTTP/3 connection and issues as session ticket \nh3_traefik-1 | 2024-06-29T11:53:03Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:228 \u003e Serving default certificate for request: \"\"\n\n# Attack script sends a 0-RTT early data request in a UDP datagram with a spoofed source IP\nattack-ipspoofing-1 | INFO:client:Building 0-RTT QUIC packet\nattack-ipspoofing-1 | INFO:client:Setting up iptables rule for source IP spoofing\nattack-ipspoofing-1 | INFO:client:Sending 0-RTT packet\n\n# Traefik accepts and forwards the request to the backend service, bypassing the IP allow list\nh3_traefik-1 | 2024-06-29T11:53:05Z DBG github.com/traefik/traefik/v3/pkg/middlewares/ipallowlist/ip_allowlist.go:85 \u003e Accepting IP 1.3.3.7 middlewareName=ipfilter@file middlewareType=IPAllowLister\nh3_traefik-1 | 2024-06-29T11:53:05Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:196 \u003e Service selected by WRR: 754e0da3b063885a\n\n# Backend service receives and processes the request\nbackend-1 | INFO:root:Request: {\"ip\": \"1.3.3.7\", \"method\": \"POST\", \"path\": \"/cmd\", \"data\": \"cmd=echo%20worked\u003e\u003e/tmp/spoofed\", \"headers\": {\"Host\": \"127.0.0.1:4439\", \"Content-Length\": \"31\", \"Content-Type\": \"application/x-www-form-urlencoded\", \"X-Forwarded-For\": \"1.3.3.7\", \"X-Forwarded-Host\": \"127.0.0.1:4439\", \"X-Forwarded-Port\": \"4439\", \"X-Forwarded-Proto\": \"https\", \"X-Forwarded-Server\": \"work\", \"X-Header\": \"test\", \"X-Real-Ip\": \"1.3.3.7\", \"Accept-Encoding\": \"gzip\"}}\nbackend-1 | INFO:root:Executing command: echo worked\u003e\u003e/tmp/spoofed\n```\n\u003c/details\u003e",
"id": "GHSA-gxrv-wf35-62w9",
"modified": "2024-07-09T21:58:14Z",
"published": "2024-07-05T20:13:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-gxrv-wf35-62w9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39321"
},
{
"type": "PACKAGE",
"url": "https://github.com/traefik/traefik"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.6"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v3.0.4"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v3.1.0-rc3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Bypassing IP allow-lists in traefik via HTTP/3 early data requests in QUIC 0-RTT handshakes"
}
GHSA-GXW8-FMH9-2W53
Vulnerability from github – Published: 2024-09-11 15:31 – Updated: 2024-09-18 21:30
VLAI
Details
An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability has been remediated in version 1.52.02.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-27113"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T14:15:12Z",
"severity": "CRITICAL"
},
"details": "An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability has been remediated in version 1.52.02.",
"id": "GHSA-gxw8-fmh9-2w53",
"modified": "2024-09-18T21:30:44Z",
"published": "2024-09-11T15:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27113"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/CVE-2024-27113"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:M/U:Red",
"type": "CVSS_V4"
}
]
}
GHSA-H2F7-QHQC-H8GV
Vulnerability from github – Published: 2024-11-12 06:30 – Updated: 2024-11-12 06:30
VLAI
Details
The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts that they should not have access to.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-10695"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T04:15:04Z",
"severity": "MODERATE"
},
"details": "The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the \u0027elementor-template\u0027 shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts that they should not have access to.",
"id": "GHSA-h2f7-qhqc-h8gv",
"modified": "2024-11-12T06:30:34Z",
"published": "2024-11-12T06:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10695"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3184380%40futurio-extra\u0026new=3184380%40futurio-extra\u0026sfp_email=\u0026sfph_mail=#file3"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53871750-6437-459f-97e1-5cf524160f09?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.